Privacy Policy
Page: /en/privacy-policy · Version of 19.08.2026
Language notice. Reference English translation. The legally binding text is the Ukrainian version at
/ua/polityka-konfidentsiynosti. In case of discrepancy, the Ukrainian version prevails.
This Policy explains what personal data the website https://lumino-lab.com collects, why, on what legal basis, with whom it may be shared, and what rights you have.
It is based on the Law of Ukraine "On Personal Data Protection" No. 2297-VI of 1 June 2010, the Laws of Ukraine "On Electronic Commerce" and "On Consumer Protection", and takes account of the principles of Regulation (EU) 2016/679 (GDPR).
1. Data controller
Individual Entrepreneur Artem Serhiiovych Hryhoriev RNOKPP: 3613710153 Address: 55/39 Vasylkivska Street, Kyiv, 03127, Ukraine E-mail for data protection matters: info@lumino-lab.com Phone: +380 66 260 35 11
2. Data we collect
2.1. Data you provide at checkout
| Category | Specific data | Required |
|---|---|---|
| Identity | First and last name | Yes |
| Contact | Mobile phone number, e-mail address | Yes |
| Delivery | City, carrier branch / parcel locker number or street address | Yes |
| Order | Product, quantity, amount, order comment | Yes |
2.2. Data you provide when contacting us
Your name, contact details and the content of your enquiry, claim or request sent by e-mail, messenger or social media.
2.3. Data collected automatically
IP address, browser type and version, operating system, device type, interface language, pages viewed, visit time and referral source. This data is processed mainly in aggregated form. See the Cookie Policy.
2.4. Data we do not collect
- Payment card data. Card number, expiry date and CVV are entered by you directly on the secure page of the payment service. This data is never transmitted to, processed or stored by the Controller. We receive only the anonymised outcome (approved / declined), the amount, the timestamp and the masked card number (last 4 digits).
- Data about the child the product is bought for (name, age, photographs) — we do not ask for it. Please do not include such data in order comments.
- Special categories of data (health, religious beliefs, ethnic origin, political opinions and similar).
The Site is not intended for independent use by children and does not knowingly collect personal data of persons under 18. If you believe a child has provided us with data, contact us and we will delete it.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Concluding and performing the sales contract: order processing, communication, delivery, settlement | Article 11 of Law No. 2297-VI — processing necessary for the performance of a transaction to which the data subject is a party |
| Generating and sending the fiscal receipt | Compliance with a legal obligation (Ukrainian law on payment transaction recorders) |
| Income accounting, tax reporting, retention of primary documents | Compliance with a legal obligation (Tax Code of Ukraine, Accounting Act) |
| Handling enquiries, claims, returns and exchanges | Compliance with a legal obligation (Consumer Protection Act) |
| Defending the Controller's rights in a dispute | Legitimate interest of the Controller |
| Site analytics and improvement | Your consent (cookies) |
| Marketing e-mails and promotions | Separate voluntary consent, withdrawable at any time |
Providing the data marked as required is a condition of placing an order; without it we cannot conclude or perform the contract.
4. Recipients of data
We do not sell, rent or share personal data with third parties for their own marketing purposes. Data is shared only to the minimum extent necessary with:
| Recipient | Data shared | Purpose |
|---|---|---|
| Nova Poshta LLC (carrier) | Name, phone, city, branch/address, declared value | Delivery, waybill, cash on delivery |
| JSC Universal Bank / plata by mono | Amount, order number, e-mail, phone | Payment processing and refunds |
| NOVA PAY LLC / NovaPay | Amount, order number, e-mail, phone | Payment processing and refunds |
| Software fiscal recorder operator | Order number, amount, e-mail or phone | Issuing the fiscal receipt |
| Hosting and infrastructure provider | Technical data, form data | Operation of the Site |
| E-mail service provider | E-mail, name, message content | Order confirmations |
| Public authorities | As specified in the request | Only upon a lawful written request |
Some of these services may process data on servers outside Ukraine, including in the European Union, which provides an adequate level of data protection.
5. Retention periods
| Category | Period |
|---|---|
| Completed order data (primary documents) | 1,095 days (3 years) — limitation period under Article 102 of the Tax Code of Ukraine |
| Cancelled and unpaid order data | 12 months |
| Enquiries, claims, correspondence | 3 years after closure |
| Marketing subscription data | Until consent is withdrawn |
| Technical logs and analytics | Up to 26 months, mainly anonymised |
After the period expires, data is deleted or anonymised.
6. Your rights
Under Article 8 of the Law of Ukraine "On Personal Data Protection" you have the right to:
- know the sources of collection, the location of your data, the purpose of processing and the Controller's location;
- receive information about the conditions of access to your data, including third parties to whom it is transferred;
- access your personal data;
- receive a reply to a request as to whether your data is processed — within 30 calendar days;
- make reservations limiting the processing when giving consent;
- change or correct your personal data;
- withdraw your consent to processing;
- demand erasure or destruction of your data where it is processed unlawfully or is inaccurate;
- protect your rights through the Ukrainian Parliament Commissioner for Human Rights or the courts;
- apply legal remedies in the event of a breach of data protection law.
Note: the right to erasure does not extend to data the Controller is required by law to retain (primary documents for paid orders, fiscal data) until the relevant periods expire.
How to exercise your rights
Send a request to info@lumino-lab.com stating your name, the contact details used for the order and the substance of your request. We reply within 30 calendar days. We may ask for additional details solely to verify your identity and avoid disclosing your data to someone else.
7. Security
- data is transmitted between your browser and the Site over an encrypted channel (HTTPS / TLS);
- access to order data is limited to the Controller and persons involved in fulfilling orders, on a need-to-know basis;
- payment card data never enters the Site's infrastructure (see 2.4);
- service accounts are protected by passwords and two-factor authentication;
- in the event of a data breach posing a high risk to users' rights, we notify affected users and the competent authorities.
No method of transmission over the Internet is completely secure, so absolute security cannot be guaranteed.
8. Automated decision-making
The Controller does not carry out automated decision-making producing legal effects, nor profiling.
9. Cookies
See the separate Cookie Policy.
10. Third-party links
The Site links to our Instagram, Facebook and YouTube pages. Processing on those platforms is governed by their own privacy policies, for which we are not responsible.
11. Changes
We may update this Policy. The new version takes effect upon publication on the Site with the version date shown. Where changes materially affect users' rights, we will additionally notify users on the Site.
12. Contacts and complaints
Data protection matters: info@lumino-lab.com, +380 66 260 35 11
Supervisory authority: Ukrainian Parliament Commissioner for Human Rights — https://ombudsman.gov.ua, 21/8 Instytutska Street, Kyiv, 01008, Ukraine.